Hipaa Compliance Auditor

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:14 AM UTC
• Version: 0.1.0

Overview

This skill is coherent in purpose, but it handles medical data and can preserve or print sensitive patient details while overstating automated HIPAA de-identification confidence.

Install only with review controls: treat all output as requiring human HIPAA review, avoid using audit logs on real PHI unless you can secure or edit them, do not rely on the APPROVED status as compliance proof, and pin dependencies in an isolated environment before processing sensitive records.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:357

Finding

Raw PHI Is Exposed Through Audit Logs and Standard Output

Content

View full analysis

str: """Extract surrounding context for a match.""" context_start = max(0, start - window) context_end = min(len(text), end + window) return text[context_start:context_end] ``` ```python def generate_audit_log(self, result: DeidentificationResult, output_path: str): """Generate JSON audit log for compliance documentation.""" log_data = { "timestamp": result.timestamp, "input_hash": result.input_hash, "confidence_threshold": self.confidence_threshold, "detections": [ { "type": d.pii_type, "position": [d.start, d.end], "confidence": round(d.confidence, 2), "replacement": d.replacement, "original_length": len(d.original_text), "context": d.context[:100] + "..." if len(d.context) > 100 else d.context } for d in result.detected_pii ], "statistics": result.statistics, "hipaa_categories_covered": list(set( d.pii_type for d in result.detected_pii )) } with open(output_path, 'w', encoding='utf-8') as f: json.dump(log_data, f, indent=2, ensure_ascii=False) ``` ```python if args.stats or not args.output: print("=" * 60) print("DETECTION STATISTICS:") print("=" * 60) for key, value in result.statistics.items(): print(f" {key}: {value}") print() print("=" * 60) print("DETECTED PII ENTITIES:") print("=" * 60) for det in result.detected_pii: print(f" [{det.pii_type}] '{det.original_text[:30]}...' " f"→ {det.replacement} (conf: {det.confide ...[truncated 1836 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:386

Finding

Incomplete Validation Can Falsely Approve Output That Still Contains PHI

Content

View full analysis

= self.confidence_threshold ] ``` ```python def validate_output(self, result: DeidentificationResult) -> Dict[str, Any]: """ Validate that de-identified text contains no obvious remaining PII. Returns validation report with warnings. """ warnings = [] # Check for SSN patterns still present if self._patterns["SSN"].search(result.cleaned_text): warnings.append("Potential SSN pattern still detected in output") # Check for email patterns if self._patterns["EMAIL"].search(result.cleaned_text): warnings.append("Potential email pattern still detected in output") # Check for phone patterns if self._patterns["PHONE"].search(result.cleaned_text): warnings.append("Potential phone pattern still detected in output") # Check confidence levels low_confidence = [d for d in result.detected_pii if d.confidence < 0.8] if low_confidence: warnings.append(f"{len(low_confidence)} detections below 0.8 confidence - manual review recommended") return { "passed": len(warnings) == 0, "warnings": warnings, "recommendation": "APPROVED" if not warnings else "REQUIRES_MANUAL_REVIEW" } ``` ```python parser.add_argument( "--confidence", "-c", type=float, default=0.7, help="Minimum confidence threshold (0.0-1.0)" ) ``` ### Technical Analysis The validation routine checks only three structured patterns: SSNs, email addresses, and telephone numbers. It does not independently validate names, dates, addresses, medical record numbers, health-plan identifiers, account numbers, license numbers, vehicl ...[truncated 2065 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Mutable and Inconsistent Third-Party Dependencies Create Supply-Chain Risk

Content

View full analysis

=3.7.0 presidio-analyzer>=2.2.0 presidio-anonymizer>=2.2.0 regex>=2023.0.0 dacite>=1.8.0 pytest>=7.4.0 pytest-cov>=4.1.0 ``` ### Technical Analysis The documented installation command resolves packages without exact versions or cryptographic hashes. Each installation can therefore retrieve different package versions and transitive dependency trees. Package installation can execute build-system or installation code with the privileges of the user running `pip`. The root and reference manifests are also inconsistent. The root file installs only `dataclasses` and spaCy, while the reference file lists additional optional and testing dependencies. This makes it unclear which manifest is authoritative and prevents reproducible review of the effective dependency set. The `dataclasses` backport is unnecessary for the documented Python 3.9-or-newer runtime because `dataclasses` is part of the Python standard library. Retaining an unnecessary package increases supply-chain exposure. No malicious package was identified in the audited files. The vulnerability is the mutable, unauthenticated dependency resolution process rather than confirmed malicious behavior by a listed dependency. ### Attack Path 1. A user follows the documentation and runs `pip install -r requirements.txt`. 2. Pip resolves the latest packages and transitive dependencies allowed by the unpinned manifest. 3. If a future package release, transitive dependency, package index, or distribution artifact is compromised, the malicious inst ...[truncated 641 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The audit log includes context derived from the original sensitive text around each detection, which can preserve PHI even after de-identification. Because the skill is specifically intended for medical records and patient data, logging surrounding snippets creates a direct confidentiality risk and may undermine the de-identification process.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes file read/write behavior but does not declare any explicit tool scope such as permissions or allowed-tools. In a healthcare/PHI-processing context, undocumented filesystem access increases the risk of over-broad data access, accidental processing of unintended files, and unsafe output of sensitive data, especially since the skill itself notes path validation and workspace restrictions are not yet assured.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module explicitly claims HIPAA Safe Harbor-grade de-identification, but the implementation only detects a subset of identifiers and relies on limited regex/NLP heuristics. In a healthcare skill, this can create a dangerous false sense of compliance, causing users to share text believed to be safe while residual PHI remains in the output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code writes PHI-derived context and detection artifacts to disk without warning the operator that the audit file may itself contain sensitive information. In the HIPAA/clinical context, this increases the chance of accidental disclosure through insecure storage, backups, file sharing, or downstream processing of the audit artifact.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown contains the statement "需人工检查 (Requires Manual Review)", which introduces Chinese-language content into otherwise English documentation without any opt-in, language selection, or documented locale rationale. This can violate language/locale policy expectations for consistent user-facing instructions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency specification uses a lower-bound only version constraint for spaCy, which makes builds non-reproducible and allows future upstream releases to be installed without review. In a HIPAA-oriented skill, unexpected dependency changes can degrade security posture or introduce vulnerable transitive packages into software that may process sensitive PHI.

Content

Scanner excerpt · references/requirements.txt (reported line 5)May include surrounding context.

text

# Install with: pip install -r requirements.txt

# Core NLP library
spacy>=3.7.0

# spaCy models (install separately):
# python -m spacy download en_core_web_trf  # Best accuracy (transformer-based)

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

presidio-analyzer is specified with an open-ended minimum version, so installations may pull in different later releases over time. Because this package is directly involved in detecting PII/PHI, unreviewed upgrades could affect both security and compliance outcomes in a system handling regulated healthcare data.

Content

Scanner excerpt · references/requirements.txt (reported line 13)May include surrounding context.

text

# python -m spacy download en_core_web_md   # Medium model, faster

# Enhanced PII detection (optional but recommended)
presidio-analyzer>=2.2.0
presidio-anonymizer>=2.2.0

# Advanced regex support

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

presidio-anonymizer is also unpinned, which creates supply-chain and reproducibility risk by permitting any future compatible release to be installed. In a de-identification workflow, changes in anonymization behavior can materially affect whether PHI is properly removed, increasing compliance exposure.

Content

Scanner excerpt · references/requirements.txt (reported line 14)May include surrounding context.

text

# Enhanced PII detection (optional but recommended)
presidio-analyzer>=2.2.0
presidio-anonymizer>=2.2.0

# Advanced regex support
regex>=2023.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The regex package is not pinned to a fixed version, so dependency resolution may vary across environments and over time. While this is a common maintenance issue, it still introduces avoidable supply-chain uncertainty in software that may process sensitive healthcare text.

Content

Scanner excerpt · references/requirements.txt (reported line 17)May include surrounding context.

text

presidio-anonymizer>=2.2.0

# Advanced regex support
regex>=2023.0.0

# Data validation
dacite>=1.8.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

dacite is declared with only a minimum version, which weakens reproducibility and can introduce unreviewed upstream changes. Although lower risk than core PHI-processing libraries, it still contributes to overall dependency-chain exposure.

Content

Scanner excerpt · references/requirements.txt (reported line 20)May include surrounding context.

text

regex>=2023.0.0

# Data validation
dacite>=1.8.0

# Testing
pytest>=7.4.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

pytest is unpinned, making it unclear which version will be installed and whether it includes known vulnerabilities or insecure behavior. Even though it is a test dependency, insecure tooling can affect CI environments and developer systems, and the separate advisory note increases concern here.

Content

Scanner excerpt · references/requirements.txt (reported line 23)May include surrounding context.

text

dacite>=1.8.0

# Testing
pytest>=7.4.0
pytest-cov>=4.1.0

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest does not pin pytest, so it is impossible to determine whether installed versions are affected by the cited advisory. This is a real risk because an unpinned dependency can resolve to a vulnerable release in CI or developer environments, especially over time as package indexes change.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

pytest-cov is also specified as an open-ended dependency, which creates the same reproducibility and supply-chain concerns as other unpinned packages. Its impact is limited because it is test-only, but it still broadens attack surface in development and CI contexts.

Content

Scanner excerpt · references/requirements.txt (reported line 24)May include surrounding context.

text

# Testing
pytest>=7.4.0
pytest-cov>=4.1.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency 'dataclasses' is unpinned, which allows different versions to be installed over time and can introduce vulnerable or incompatible code through supply-chain drift. In a HIPAA-focused skill that may process sensitive medical text, dependency unpredictability increases risk because compromised or breaking package updates could affect confidentiality or reliability of de-identification workflows.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses
spacy

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The dependency 'spacy' is unpinned, so builds may silently pull newer releases with security issues, malicious upstream compromise, or behavior changes that affect PHI/PII detection accuracy. Because this skill is intended for HIPAA compliance on clinical text, unstable NLP dependency resolution is more dangerous than usual: it can lead to missed de-identification, data leakage, or operational failures in a sensitive healthcare context.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

dataclasses
spacy

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The docstring mixes English with the Chinese phrase '需人工检查', which imposes a locale/language choice in natural-language content without user opt-in or justification. This can violate language/locale policy expectations for organizational consistency.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.